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Critical Infrastructure Protections: The 9/1 1 
Commission Report and Congressional Response 

Summary 

Many of the recommendations made in the 9/11 Commission’s report dealt 
indirectly with critical infrastructure protection, especially as the goals of critical 
infrastructure protection have evolved to include countering the type of attack that 
occurred on September 11. However, relatively few of the recommendations 
addressed critical infrastructure protection specifically. Those that did called for 
using a systematic risk management approach for setting priorities and allocating 
resources for critical infrastructure protection. None of these recommendations 
advocated a change in the direction of, or the organizational structures that have 
evolved to implement, existing infrastructure protection policies. Nevertheless, the 
Commission’s recommendations could speed up implementation in some areas, 
given the attention and renewed urgency expressed by the Commission. 

Two bills were introduced as legislative vehicles for enacting some or many of 
the Commission recommendations (S. 2845 and H.R. 10). Like the Commission’s 
recommendations, the language in these two bills, and the subsequent Intelligence 
Reform and Terrorism Prevention Act of 2004 (P.L. 108-458), for the most part, 
strengthen or reinforce existing policy and organization associated with critical 
infrastructure protection. 

For a more detailed discussion of national policy regarding critical infrastructure 
protection, including its evolution, implementation, and continuing issues, see CRS 
Report RL30153, Critical Infrastructures: Background, Policy, and Implementation. 
For a discussion on the use of risk management techniques in the context of critical 
infrastructure protection, see CRS Report RL3256 1 . Risk Management and Critical 
Infrastructure Protection: Assessing, Integrating, and Managing Threats, 
Vulnerabilities, and Consequences. 

This report will be updated as appropriate. 
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Introduction 

Federal efforts to protect the nation’s critical infrastructure pre-date the 
September 11, 2001 attacks on the World Trade Center and the Pentagon. Since the 
attacks, critical infrastructure protection has evolved to include countering that type 
of an attack. Because the purpose of the Commission’s report was to answer, “How 
did the terrorist attack of September 1 1 , 200 1 happen?” and “How can such a tragedy 
be avoided in the future?,” most, if not all, of the recommendations made in the 9/1 1 
Commission’ s report deal indirectly with critical infrastructure protection. However, 
there are relatively few recommendations that specifically address critical 
infrastructure protection. This report will identify those recommendations and briefly 
discuss the possible impacts those recommendations and the subsequent 
congressional response might have on the nation’s efforts to protect its critical 
infrastructure. 

Recommendations Related to Critical Infrastructure 
Protection 

Much of what the Commission recommended for critical infrastructure 
protection can be found in Chapter 12, Section 12.4 of the Commission’s report 
(Protect Against and Prepare For Terrorist Attack, starting on page 383). 

The majority of this section is devoted to the importance of disrupting terrorists’ 
ability to travel unchallenged around globe and into the United States. It discussed 
the integration of travel intelligence gathering and analysis with border protection 
and law enforcement operations. It discussed screening techniques and technologies 
to be integrated at all points in the process, from visa application to walking through 
detectors at entry points, to checking identification upon entrance to certain sensitive 
facilities. This section also discussed at some length the need to incorporate 
biometric screening technologies into the processes. These issues, however, are 
beyond the scope of this report. For more discussion of these issues, see the 
Homeland Security: Border and Transportation Security page on CRS’s 
Congressional Legislative Issues webpage. 1 

Section 12.4 of the Commission’s report also focused on issues related to 
securing the nation’s transportation sector from attack (see page 390 of the 
Commission’s report, “Strategies for Aviation and Transportation Security”). In 



1 See, [http://www.crs.gov/products/browse/is-homelandsecurity.shtml] 
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this section, the Commission mentioned the Aviation and Transportation Security 
Act (P.L. 107-71) which established the Transportation Security Administration 
(TSA, which is now part of the Department of Homeland Security). Among other 
tasks, the act assigned the TSA the responsibility of developing strategic plans to 
provide security for critical parts of the U.S. transportation system. The Commission 
expressed concern that 90% of the annual federal investment made in transportation 
security goes toward commercial aviation security without a systematic risk 
assessment to determine if this is the most cost-effective allocation of resources. The 
Commission noted that “major” vulnerabilities still exist in cargo and general 
aviation, and that the security improvements in commercial air traffic may shift the 
threat to ports, railroads, and mass transit systems. The Commission noted that the 
TSA has yet to develop an integrated plan for the transportation sector, nor specific 
plans for the various transportation modes. 

The Commission reiterated the need for the federal government to: 

• identify those transportation assets that need to be protected; 

• set risk-based priorities for defending them; 

• select the most practical and cost-effective ways to do so; 

• develop a plan and a budget; 

• and, then fund implementation. 

The Commission went on to recommend that Congress set a specific date for the 
completion of the plan and hold the TSA and the Department of Homeland Security 
accountable for achieving it. 2 

In regard to aviation security, the Commission recommended the timely 
implementation of improved “no-fly” and “automatic selectee” lists (including the 
recommendation that air carriers be required to supply information to help develop 
these lists) and that a greater priority be given to detecting explosives on passengers 
and on studying human factors affecting the effectiveness of screeners’ performances. 

Also in Section 12.4, the Commission again discussed the need for a systematic 
assessment of risks, vulnerabilities, threat, and need when allocating federal 
resources to help states and localities protect against and respond to terrorist attacks 
(see page 395 of the Commission’s report, “Setting Priorities for National 
Preparedness”). The Commission suggested that these federal funds should act as 
a supplement to state and local funding in those instances where additional protection 
is merited based on the systematic assessment, and not as part of a general revenue 
sharing mechanism. The Commission suggested that these assessments should 
consider such factors as population, population density, vulnerability, and the 
presence of critical infrastructure within each state. 

Furthermore, the Commission recommended that a panel of experts be convened 
to develop a set of benchmarks by which to evaluate a community’s needs and by 
which to distribute federal funds through the state to those localities. 



2 The Commission continues to make this point in subsequent Congressional hearings. See, 
“Deadlines Urged for Terror Fixes”, Washington Post, August 17, 2004, p A13. 
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Finally, the Commission made a recommendation at the end of Chapter 13, 
Section 13.4 (see page 428 in the Commission’s report), which specifically addressed 
all critical infrastructure. The Commission, in discussing the different roles assumed 
by the Department of Defense and the Department of Homeland Security in 
homeland security, noted that DHS is responsible for identifying, within the sectors 
that possess critical infrastructure, those elements (or assets) that need to be 
protected. The Commission recommended that DHS, and its oversight committees, 
should regularly assess the types of threats the country faces to determine a) the 
adequacy and status of the government’s plans to protect critical infrastructure and 
b) the readiness of the government to respond to those threats. 

Potential Impact of Commission Recommendations on 
Critical Infrastructure Protection Activities 

The Commission recommendations specifically directed at critical infrastructure 
protection, while lending the weight of the Commission to certain elements of 
existing federal policy, do not advocate any change in the direction of, or the 
organizational structures that have evolved to implement, that policy. The 
recommendations, however, could speed up implementation is some areas, given the 
attention and renewed urgency expressed by the Commission. 

Federal policy on critical infrastructure protection is laid out in law, presidential 
directives, and national strategies. 3 As noted by the Commission, the Homeland 
Security Act of 2001 (P.L. 107-296, enacted in November 25, 2002) assigned to the 
Department of Homeland Security the task of coordinating the national effort in 
critical infrastructure protection. Specifically, it gave DHS the responsibility to: 

• “... identify and assess the nature and scope of terrorist threats to the 
homeland;” 

• “... understand such threats in light of actual and potential 
vulnerabilities of the homeland;” 

• “...carry out comprehensive assessments of the vulnerabilities of the 
key resource and critical infrastructure of the United States, 
including the performance of risk assessments to determine the risk 
posed by particular types of terrorist attacks within the United States 

• “... integrate relevant information, analyses, and vulnerability 
assessments. ..in order to identify priorities forprotective and support 
measures....” 

• “... develop a comprehensive national plan for securing the key 
resources and critical infrastructure of the United States ....” 

• “... recommend measures necessary to protect the key resources and 
critical infrastructure of the United States ....” 



3 For a more thorough review of national policy and its evolution and implementation, see 
CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation. 




